All right, guys, welcome back.
In the last video we have seen how we can bypass the certificate pinning, which is based on an edge.
In this video right now, we take a look at the second option certificate pinning based on an hold certificate.
And for me, to be honest, this is way more easy.
So this is like having a pony under the Christmas tree.
So therefore, let's have a look into this.
Okay.
So let's have look into this one.
I have already downloaded it and it's over here.
Download certificate pinning underscore cert.
I copy this and we go into EPS and we create a new directory and certificate pinning underscore start.
All right, let's install this application and keep this in foreground.
Yes.
ADB installed cert pinning underscore cert.
Yeah.
So I have provided the same package name to this one over here as the last one.
So both certificate pinning, underscore, search and hash have the same package name and they also
are both signed with the same key.
Therefore, we have overwritten the existing version.
That's why we have now this amazing pub logo over here.
So this doesn't matter at all.
We have just overwritten the old one.
All righty.
So now let's open this one.
And here we can see it's making directly and request to our API endpoint.
And here it's the same text.
And you also see this successful at the end.
We also have very nice layout over here.
Do we?
Absolutely.
So we also got this pattern.
This means we can trigger those requests successfully and so on.
The app is working regularly and this means if we now encounter errors after setting up our man in the
middle attack and this might be related to our man in the middle attack, and let's have a look.
So first let's run the burp suite and therefore we have to go into tools and burp suite and then we
run the password community.
Let's close them.
Click next use verb default.
Okay.
Yeah, we have not above speed.
We can close this one.
Then within proxy options, we edit this interface and we go into a specific 1040 201 and we enable
invisible proxy.
All right, this looks good right now.
So let's establish our IP table rules.
Therefore, we are opening a new route.
Okay.
And now we want to create a new IP table rule.
Maybe let's first print them out.
Nothing in there so far.
No IP tables.
There's not.
Then we want append a new pre routing rule.
Protocol is TCP destination.
Port is 80 and we want to change the destination address to destination 1042 zero 188 and there's also
for https.
Okay.
And we can see Arrow.
Do we have an attack out?
So suddenly I hit the button or the request got triggered again?
Not sure what's the reason for this one, but let's see if we if we hit this button once again.
Yes, within the dashboard we get an arrow TLS fade, negotiate a Telus connection, for example.
Dot com.
Our certificate is unknown.
All right.
This application seems to pin a certificate.
It's not working anymore.
Let's have look into this.
Let's reverse engineer how this is being done.
Alrighty.
So.
Let's close them.
Then we go into this directory and this time I'm using Shadi X again and Shadi school.
So the application is being decompile.
There we have it.
And our first look is into the Android manifest.
From.
There we go.
We've got Internet permission.
Of course, we only got one activity.
And let's see, we have network security config.
Yes, we have.
Oops.
Sorry.
There we have it.
It's again within the XML directory of this application.
So.
Yet.
We can look it up here on the resources XML.
We have this config file and this one has now intrust anchor regarding to a certificate and this is
within the raw directory and it's named server.
So let's look into raw.
There we have it server.
So that's the binary format of this certificate.
And we can see it's regarding to example dot org.
Nice.
This looks very promising right now.
So how is this certificate being checked in the application code?
And therefore, let's have a look into the main activity.
This one.
We also can see cert piano helper sounds promising.
So within human activity, we've got our basic layout.
Then we've got our inherited class, our subclass.
And this one is doing something in the background certificate help.
This one is calling this one over here.
And here we're providing.
Yeah.
Parameter some context inclined.
And then let's see, we are opening this URL example dot com and everything happens afterwards.
So our certificate pinning.
Yeah.
It seems to be related in this class over here.
So let's have a look into this one.
Okay.
So here we are now with the certificate and let's have a look into this one.
In this line.
That's a construct that we are creating a new 509 trust manager.
A trust manager is simply just an instance that is managing our certificates.
So that's that's a good point over here.
Let's see, this one is being initialized with this function and this one has another function as parameter.
So let's start over here.
And this one is returning an input stream.
And this input stream is related to our resources raw server.
So this is our server, the file that's being returned in this input stream.
Nice.
This means if you replace the the server, the file in this one gets loaded into this trust manager
over here.
Absolutely perfect.
This means we do not have to bother about other stuff here.
We simply only need to replace our server the with the one of the burp suite.
This should be all right now.
If not, then we have to dig deeper into this.
But for now, let's.
Let's have a quick look.
Maybe.
So this is just returning our certificate.
Then we've got this trust manager for certificates.
This one is finally returning our trust manager.
And this is our certificate as input.
Here we can see this really good and certificate factory get instance.
So here we are generating a new certificate based on ours.
If this one is being empty, then we are creating a new password and we are creating a new key store.
All right.
Otherwise, we move on with this one over here.
So far, it looks pretty good.
Let's simply go for the approach, replacing the server, the file, and then let's see if this works
out.
If not, then we have to go back into this once again.
All righty.
Okay.
So, therefore, let's close this one.
Let's get into our apps directory and let's decompile this APK tool D.
All right.
It's been compiled.
Och cert pinning cert now within rests.
Roar.
Oops.
All.
All right.
Okay.
So now we are in cert pinning cert rice in the raw directory and here we are having the server, the
cert.
If we double click this one, we can see, all right, this is the cert that might be pinned.
It's regarding to example dot org.
So we are pretty confident that this one is the cert.
Okay.
So what we need to do is we simply get our birth certificate in the format and then we replace them
with this one over here.
That's all.
Let's go into the burp suite.
Proxy options.
Import export certificate.
The format.
Then select it over here.
Convert the.
Ah.
Save.
And now let's go into this directory.
And we simply drag and drop it over here.
All right.
Let's verify this real quick.
Yes, this is our absolute cert.
It expires.
Pretty has some pretty extensive date when it expires.
All right.
And now let's do the magic.
So what we do right now is the following year deleting or we are renaming this one.
Okay.
And now we can delete it and we rename this one over here and that's all.
So having a certificate file directly in this application, that's yeah.
That's money under the Christmas tree.
That's the, the easiest approach to go for.
All right.
The only thing we need to do is we need to adjust the network security config to generally trust the
user certificate storage.
We can find this information within within the Android developer documentation.
And this one over here.
There we go.
This is the text we need to apply to to generally trust our backups with certificate.
So let's get into the network security config.
This is within XML.
This one over here.
So let's edit it.
Okay.
I guess we only, we only have copied out the base config.
So you need this network security config tech at the beginning and at the end.
All right, now let's simply build this application back again.
Maybe Kate will be.
Okay, then let's sign this application.
First, we need to align it for bytes.
Called.
Successful And now we are using EPC sign a password, change it.
All right.
And let's uninstall this pretty awesome looking application first.
Let's close this one on.
And son.
And now let's install our version out.
Okay.
Success.
Opening the above speed dashboard is still throwing some errors, but we do not care about them.
All we care about is our application in this one.
Let's open this and let's see.
Nice.
So the interceptor over here is flashing.
So they are here.
We can see the request.
Let's follow this one.
And we get.
Do we have an attacker once again?
No, definitely not.
Otherwise, we wouldn't have seen this request.
This application will definitely abort any connection before it sends out request.
If you take a look at the history, we can see again, we've got the request and the response.
So we're.
It's regarded to whoop too.
Let's have a look into the project options HTP and it's within the default settings.
So unfortunately, let's keep it this a bit.
Alrighty.
Now let's apply our response rule that we can directly hack this application so we go into options.
Then this time I do it.
Correct.
So intercepts of our response at the main matches any short work?
Okay.
Intercept this on send request.
That's the request.
Here is the response.
Hecht Once again, I guess the title is not being displayed, so we need to put it in here.
Hecht Once again, certificate pinning.
So what?
For what?
There we go.
Hecht Once again, certificate pinning.
So what?
Nice.
This is how to patch the certificate pinning approach based on an old certificate.
Easiest approach.
Okay.
Last but not least, I would like to show you something over here.
It might be the case that the developer does not start the certificate itself.
Instead, the developer is using an old key store which is being protected by password.
And even this would be absolutely no big deal for us.
We could simply replace the whole trust store.
How can we do this?
We have already created our own trust store and this one is holding our certificate that's being used
to sign our applications.
And this one over here.
So if you go back into this one and here we have our own trust for our key store.
And for example, if you want to display these certificates in this key store, then we can do this
as follow.
We can use the key tool and then we can say list.
The certificates in this key store, and we provide the key store, Android App Store.
Now we need to enter the correct password.
And in case if you're entering a wrong password and this one, for example, then we get this, this
arrow key.
So password is incorrect.
But if we are opening this with the correct password, in this case, it's change it.
And then we can see now all the certificates that's been stored in here, we can see we have one with
the alias name, alias underscore name and one with Udemy.
So all we need to do is we need to get our birth certificate into an own key store over here, this
one, or creating a new one.
And then we have to take a look into the application.
Which password is being used to open this key store in case no password, I guess you have to provide
a password.
Therefore there will be something in here and then we have to choose the same password for our key store
or we have to patch the password over here.
So the approach is absolutely the same.
Instead of replacing the ah, we are replacing the whole key store, this one over here.
So we simply drag and drop this into the application directory and then the applied is password and
we are going to go, all right.
So this is how you can deal with certificate pinning.
If you have some error questions, feel free to write me a message.
I'm glad if I received this feedback and yeah, we will figure out what's the problem for you and we
will try to patch it together if you have the permission for this application to do so.
Alrighty.
Okay.
In the next video we will finish our certificate patching journey with an yeah.
But then transition into our next topic.
We will perform a random manipulation.
So we will have our first introduction to freedom because there are some amazing frameworks out there,
like abstraction, which is doing an runtime manipulation approach to get rid of certificate pinning.
So there are some pre patches regarding to core libraries likely to be three, but we can simply patch
it away with just two or three lines of code.
All right.
Okay.
So feel free to play around with this one.
And yeah, otherwise, I'm looking forward to see you in the next video.